CVE-2026-105901: Incorrect Authorization (CWE-863) in Adobe ColdFusion 2025

CVE-2026-105901 is an Incorrect Authorization vulnerability in Adobe ColdFusion 2025 that enables a low-privileged attacker to execute arbitrary code in the context of the current user. The vulnerability does not require user interaction and results in a changed security scope. The CVSS 3.1 score is 8.8 (high severity) with vector AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, indicating local attack vector, low complexity, low privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability. Affected versions include all versions up to and including 2025.0.13 and 2023.0.25.

Successful exploitation allows a low-privileged attacker to execute arbitrary code with the privileges of the current user, potentially leading to full system compromise including confidentiality, integrity, and availability impacts. The scope of the vulnerability is changed, meaning the attacker can affect resources beyond their initial privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or fix information is provided in the available data. Until a patch is available, restrict local access to trusted users only and monitor for suspicious activity related to ColdFusion.